OAuth callback hardcoded to localhost breaks authentication in VMs

[kylemumma]

The MCP test client's OAuth callback is hardcoded to http://localhost:8765/callback. When running inside a VM or container, the browser (often on the host) cannot reach this localhost address, so the authentication flow cannot complete.

Findings

• packages/mcp-test-client/src/auth/oauth.ts hardcodes OAUTH_REDIRECT_URI = http://localhost:8765/callback and starts the callback server on 127.0.0.1:8765.
• There is no environment variable or CLI flag to override the redirect URI or callback port.
• Remote mode supports SENTRY_ACCESS_TOKEN as a workaround, but the OAuth flow itself is unusable in non-local environments without manual port forwarding.

[linear-code]

MCP-996

[sentry-pierre]

Hi, I'm Pierre!

Merci for the report. I cleaned this up a bit so the specific OAuth limitation is clearer.

What I checked:

• packages/mcp-test-client/src/auth/oauth.ts hardcodes the OAuth callback to localhost:8765.
• Remote mode does support SENTRY_ACCESS_TOKEN as a workaround if you have a token already.

A maintainer can take it from here.